Slashdot Mirror
UK Banking Law Blames Customers For Insecure OS
twitter writes "If you use an insecure OS in the UK and someone drains your bank account, the banks say it's your fault. The Register reports: 'The Banking Code produced by the British Bankers' Association (BBA), and followed by most banks, makes it clear that banks will not be responsible for losses on online bank accounts if consumers do not have up to date anti-virus, anti-spyware, and firewall software installed on their machines.'" twitter went on to note that the majority of consumer PCs use an operating system with a history of security issues. Should end users be ultimately responsible for the state of their systems?
This should be fun.
Help stamp out iliturcy.
But I think there's an ulterior motive here. As a part of Chip-and-PIN, the UK is testing a brilliant two-factor authentication system this year for cards that will cryptographically render browser, PC, and merchant security moot. It's possible this is being used as a "warning shot" to frighten consumers into picking up the tab for the high cost (approximately $70) of the handheld security module.
They have the technology to keep it safe now. I think they're just too cheap to fund it themselves. (And I really wish we'd start seeing that kind of security technology available here in America. I'd switch banks and pay the $70 myself in a heartbeat.)
John
So, to summarize:
bankers: "You better use a secure OS, or you'll be liable for any fraudulent transactions with your account."
customers: "Okay. What if we use Firefox on Linux?"
bankers: "That'll work."
customers: "Hey, we can't access your site using Firefox!"
bankers: [British equivalent of "hah! Sucks to be you!"]
Apology to Ubuntu forum.
The police department will not be held responsible for the robbery of any house not armed with bulletproof glass, anti-personal mines, and a moat.
"Never let your sense of morals prevent you from doing what is right" - Salvor Hardin
Look, if an account compromise occurs as a result of a compromise on the bank's side (web server, backend network, etc), it's the bank's fault. If the compromise occurs because the user's login gets sent to some dude in Russia by a keysniffer running on the user's already compromised workstation, it's MOST DEFINITELY the user's fault. This isn't complicated. Wow.
Suppose one is running a hardened version of OpenBSD on some PA-RISC machine. Suppose then that this person's bank account is drained out and that said draining has NOTHING to do with their computer or OS. Suppose it's drained by someone who prints checks with a random bank account number on them and it just so happens to be this OpenBSD user's bank account. Again, the theft has NOTHING to do with their computer, OS, computing practices, or hair color. What will happen? Will the bank file a discovery motion to check if the person has anti-virus software on their hardened machine? What? No anti-virus software? Never mind that there is no virus to check for. This is scary as it gives the bank a way to weasel out of its own responsibilities.
McCain/Palin '08. Now THAT's hope and change!
In the US, a friend of mine (a lawyer) basically described the state of banking laws as "the bank is always right, if the bank is wrong the bank is still right". This was based on 1930's banking laws when the banks went to the gov't looking for a bail out and convinced enough people to severly restrict their liability.
If there is a lawyer in the house can they confirm this?
Not sure what the state of the laws are elsewhere, but knowing what a bunch of whining snivelers the banking industry is it's probably the same. The bank is always right and the depositors and the taxpayer pick up the bill.
putting the 'B' in LGBTQ+
I just seen on news the same news about our Polish banks. And to be honest, I can't see any way security can be made when used compromised operating systems on client's accounts. Even USB tokens are not enough when someone else than you controls your PC.
Should end users be ultimately responsible for the state of their systems?
The Microsoft Windows OS is not the property of the consumer using it. It is the property of Microsoft used under a license from Microsoft. If the usage of the OS complies with the license then surely any inadvertent behavior on the part of the OS is the responsibility of the owner (Microsoft) and not the license holder (the end user).
]{
As long as the bank offers an online banking system which relies on inherently insecure systems, the bank should be responsible, especially considering that they could phase out risky systems and only offer a smart card based system with class-3 readers where the customer can see the transaction on secure hardware.
1. How do they know whether or not one's computer had an AV, anti-spyware, and firewall software installed at the time it was supposedly compromised? (Privacy issue.)
2. Bank customers do have some responsibility in security. Analogy: A homeowner has no locks, leaves door unlocked all day long, then tries getting his or her insurance company to pay out when he or she is ripped off.
3. AV, anti-spyware, and firewall. All three must be done? I think most people are familiar with the AV and firewalls, but how many know about anti-spyware software? (I believe Lavasoft's AdAware is one program.) What they should do is say that the person must make a reasonable attempt at securing their computer. (This could include having a separate computer used solely for banking, and nothing else.)
4. A thought just crossed my mind. Will they deny a claim if someone just happens to have an unsecured computer, even if the computer never was used for banking?
I'm pretty freaking tired of all this "advice" that you need this protection for Windows machines.
Why should I have a firewall? I have a NAT router (hardware firewall).
Why should I have antispyware? I know what I'm downloading.
Why should I have antivirus?
- I don't download cracks. When I DO need to use a crack I upload it to virustotal and then run it in a virtual machine.
- I run IE7 and Firefox. Although neither are perfectly secure I don't make it a habit to go to Russian warez sites.
Dear god, SOMEONE explain to me why any reasonable user should need this resource-hogging crap?
Yes and no, really. The bank should have safeguards to protect against fraud (e.g. my bank has halted a purchase and phoned me because it was a reasonable sized computer purchase that I didn't normally make) but at the same time then if the user has been phished/keylogged because they haven't been paying attention and taking the correct precautions then why should the banks shell out?
It's a bit like expecting you car insurance to cover an accident when you've had dodgy brakes and a windscreen covered in crap - you could have avoided it if you had cleaned up and made sure it was safe, and there's nothing the insurers can do to do it for you.
I'm glad someone's finally doing this. People can't keep using the internet and keep being ignorant of computer/internet technology at the same time. Wise up or GTFO. You can't have your cake and eat it too.
That being said, insecure OS or not, if the user will download and install any random program, they're going to "get hacked" no matter the OS they're running.
Maybe not
Someone who obtains a bank account number via spyware is ethically (and should be legally) no different than someone who obtains a credit card number by picking someone's pocket.
People can be be so negligent that they are practically asking for their wallet to be stolen... in which case they should share some of the responsibility for the theft. But the criminal is still guilty of a crime.
Banks can also be negligent, by not keeping tabs on account activity, or not taking several other measures that can reduce theft and fraud. If they do not do those things, then they should share some responsibility, too.
I see nothing new here, unless the banks are trying to weasel out of their share.
even if a user's computer has a keylogger installed, the bad guys would only be able to steal the access code, not the password of the user - because the passwords are from a list and are unique for each session. At least that's how they do it in all banks in Finland. Once the user is logged on, to start a new (parallel) session, a new password would be requited, even if the bad guys would manage to steal the one-time password just when the user is logged on.
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
with no need for antivirus, I have read in the past some banks consider that an insecure OS because they don't understand it (much less support it on their Windows driven sites).
No "sensible" person leaves their cheque book open, with 25 presigned cheques ... because the bank could hardly be held responsible if someone stole that chequebook and emptied your account.
... because no insurer would ever pay out for the theft of that car.
... this culture of "what the hell, someone else can be the scapegoat" make us all too lax ...
... maybe if you knew that YOU were going to have to pick up the tab for your losses, you'd take a bit more care about what you do online.
... but MSIE, Firefox, any other solution is really academic ... ANY solution is only as secure as the PC you are running on, and a keylogger logs keystrokes from ANY application ... so be 110% sure you DON'T have a keylogger before using online services ... and don't expect someone else to pick up the tab when you screw up. Because let's face it, it ISN'T the bank picking up the tab anyway, it's the rest of us.
No "sensible" person leaves their car wide open, with the engine running
So why is it okay to leave your PC "wide open" and the banks have to pick up the tab ?
Your security is your own personal responsibility
I like this proposal
Okay, so the banks are two faced for talking about secure browsing, and then only accepting Internet Explorer
if i had a substantial sum of money to keep in to a checking or savings account (many thousands or millions) i would insist that no electronic transfers of cash are allowed on my accounts from any PC no matter what OS & web browser is used or i go elsewhere, this sounds like a good way for corrupt bank managers to wipe people's accounts clean = "hmm, you must have been using an insecure OS" (makes a good excuse)...
Politics is Treachery, Religion is Brainwashing
Measuring security by the number of AV programs is like rating the health of a person by the number of medicines they take and the number of band-aids on them. The more medication and the more patches over the cuts and sores must mean that they are healthier ?
I seriously doubt many juries, comprised of fellow bank customers, would agree after someone files a lawsuit against those banks who say it's the customer's fault.
does this mean that their TV ads, etc, are going to have to stop showing people doing on line banking ?
Banks shouldn't be allowed to push security issues onto their customers. If a major portion of home PC's have too many security issues for secure banking to be implemented than it's unethical for a bank to implement the feature: Regardless of demand!
The banks should take the fall on this one.
Someone finds a security hole in IE7 or Firefox. At the same time, they find a security hole in IIS or Apache. Using both these holes, they attack some well known and trusted site, maybe a newspaper, and use it to do drive-by attacks on visitors.
Yes, this does happen.
One of the financial companies that I have an account with (Scottrade) gives all their customers a free license to McAfee antivirus.
I know that several ISPs do the same thing for their customers.
This seems to be a *far better* preemptive solution to the problem - trying to make sure the customer never gets infected in the first place.
client rings up the bank, 'i have been stolen from',
bank rep asks: whats your operating system:
client says: mac osx
rep says: im sorry sir that means your liable for the losses
client asks: why
rep says: you dont run norton antivirus, only norton antivirus protected computers are safe. Thank you for banking with us, can i help you with anything else?
The blame lies with everyone involved: (1) The banks who do not strive to achieve adequate protection against fraud or identity theft because there is a point at which the amount of effort needed to further reduce the risk exceeds the financial benefit to do so. (2) Law enforcement and government, whose primary concern is punishment, employ an antiquated bureaucracy that is ill-suited to correct issues arising from identity theft, and are too reliant on numbers, databases, and records when taking action. (3) The systems designers, who share little if any accountability for their product, because users of such systems (be it government, corporations, or the people) only seem to care when those systems break. (4) The criminals--you know, the ones who perpetrate the actual theft or fraud. (5) The consumer, who, through ignorance and blind faith, does not educate and protect themselves.
But you know what? As long as everyone keeps pointing fingers at everyone else, the real loser here is (5). That's why (1-4) do what they do--at the end of the day, none of them lose through their action or inaction, because (5) does not hold them accountable. And that, my friends, is the only crime they are ultimately guilty of.
I wholeheartedly agree. It's only logical. Banks are responsible for the security within their own networks and their web servers which are on the edges. That is Just Fine.
I (The Bank Customer) am 100% responsible for the security of my own systems that I use to access the banking website. How could I POSSIBLY expect the bank to be liable for rootkits, malware, spyware, etc. I can't. That's just not reasonable.
The only thing I can think of that might go either way would be DNS type hacks since that would depend on how it was done and just exactly what point in the communication it was affecting.
Now with that being said.........
It would be the BANKS'S RESPONSIBILITY to TELL the consumer THE BAD NEWS. I can't wait. That's a "shitstorm" waiting to happen.
So basically, the vast majority of PC's are hopelessly insecure. We could talk forever about Microsoft this and Microsoft that, and "what about Safari?", blah blah blah blah. The situation is still the same. The Bank Customer's computer is just not secure enough in most cases and it could only be a matter of time before you are the "lucky" one and get nailed. Kind of like a lottery, except you get bent over.
In the end the only thing that will happen is that people will stop using online banking. I know plenty of people now that outright refuse to use it for the perceived security risks NOW. If the bank's outright say that they will not be responsible for the security on your computer, that will only make the situation worse (for them).
I'm pretty good at securing my systems, but even I know it would only take one determined person to get me. If the bank will not at least insure my losses, I can't take the risk of online banking. That simple.
If this really does go down, that will be a pretty big statement about PC security in general. Regardless of who is responsible, if a bank says it will no longer trust the end user's security that is a bad omen for the rest of e-commerce. What about the credit card companies? How will they react to the bank's position?
Fair enough, so if you don't need it, you won't be needing to make a claim to the bank for your stolen money back, presumably.
== Jez ==
Do you miss Firefox? Try Pale Moon.
This may sound facetious, but is any system really secure from keylogging?
I dual boot Ubuntu and Windows. If I type:
sudo apt-get install lokkit (as an example, not an accusation) how do I know I'm not getting a free keysniffer as an added bonus?
I run windows with a firewall, have a firewalled router with minimal ports forwarded, use ad-aware/the windows spyware program/spybot search and destroy as well as AVG. How do I know that none of these pieces of software are, in themselves, spyware/keylogging software? How do I know that my browser hasn't been attacked by some 0-day hack embedded in an ad banner despite rigorous/consistent upgrading of both of my OSes?
Are people really diligent to that point that every time they're about to do their banking, they close all active programs, update and run their suites of virus scanners and anti-spyware software, and *then* do their banking once the all-clear is given by all programs?
Honestly, I just see it as a game of probabilities. *Most likely* I don't have a key logger installed on my system, and *most likely* my banking experience is going to be a sane one, but if the shit ever hits the fan, I'm willing to bet that there are people hired to specifically poke holes in my system and say "Linux is an unapproved OS. We can't cover your banking losses."
I look forward to a better solution.
My old bank closed my online banking account without warning, and without bothering to tell me they had. I called them and they said it was because "I had a virus". This, despite the fact that I run a secure operating system (with no known viruses) and have an up-to-date virus scanner. Couldn't they just suspend my account until I "fixed" the problem? No, I had to open a whole new one.
I did. At another bank.
OTOH, you have sites that REQUIRE Windows. Yet, OTH, you have sites like this that will require a secure OS. That means by all legitimate definition of secured, that Windows is out. This will drive them batter.
There's many, many companies out there running important financial machines on a certain large software vendor's OS without proper group policies or even passwords. Still! Whole networks with unpatched NT machines with blank superuser passwords. These companies will be struggling to become Sarbanes-Oxley compliant for years to come.
https://personal.vanguard.com/us/help/SecurityOnlineFraudPledgeContent.jsp
So what happens if you're a Mac or Linux user and those security programs don't exist for your platform or they are unneeded? Can they just deny your claim and you lose all your assets for using an OS with a higher track record of security?
I guess that's better than TreasuryDirect's policy on the issue which states that they're not responsible if someone cleans out your account as long as it was done with your password.
Regulations Governing New TreasuryDirect System 31 CFR Part 363 363.21 Who is liable if someone else accesses my New Treasury Direct account using my password? You are solely responsible for the confidentiality and use of your password. We will treat any transactions conducted using your password as having been authorized by you. We are not liable for any loss, liability, cost or expense that you may incur as a result of transactions made using your password.
... from physical cheque books and credit cards. If I leave my wallet in a place where cards, etc. might be stolen, I'm responsible for any loses that occur - shouldn't the same be true if I leave my electronic 'wallet' open? I really think that, within limits, people need to be held responsible for their actions/inactions - too much 'I never realised/knew/expected/thought that might happen' in the world. The banks should have similar guidelines to those used for stolen physical banking paraphernalia - if you suspect your PC might have been compromised, report it to the bank within a given time fame and they thereafter accept responsibility for subsequent losses.
I am bald
are these the same banks that don't support anything but IE, i have to fake it with my browser of choice (opera) with my bank (abbey) or read and digest their unsupported browser legalise.... so, we can't use basic standards, but we are responsible for when we're shoehorned, nice.
Comment removed based on user account deletion
A few questions...
If banks with probably one of the industries with the most extensive resources to provide security can not protect their own online applications, how are customers, with much less resources supposed to do it?
If Microsoft - with all their resources, including their engineers, who wrote the software - can not guarantee their operating system - how are customers (brick layers, hair dressers, teachers, bank clerks) supposed to protect it?
If Microsoft keeps hiding the source code of their software - how is anybody else supposed to be able to guarantee the security of their software?
Laws like this will put out of business e-commerce and possibly Microsoft once customers world-wide will start to sue their banks and Microsoft.
We can just return to the happy era of cash and bank branches with lots of tellers and long business hours.
Every time I log onto this bank (US Bank) with my favorite Opera, I get a popup bitching about my browser - I contacted them they replied:
-----
The technical issues you are experiencing can be caused by the use of an unsupported browser or
incompatible browser settings. Please check to make sure you are using a supported browser. If you
are, please check the browser settings for your browser type by following the procedures listed below.
Operating System: Microsoft Windows 2000
Microsoft Windows XP
MacIntosh OS X
-----
And, they claim this on their site:
Browsers
The following browsers are compatible with U.S. Bank hosted web pages and web-based applications:
Microsoft® Internet Explorer 6.0 or higher
Firefox
Safari
Upgrade Your Browser
It's quick, easy, and free! Even if you already have the required minimum browser version, you may want to consider upgrading. Just follow one of these links...
Microsoft Internet Explorer Downloads *
Firefox Product Downloads *
Safari Downloads *
Find Your Current Software Information
To find your current software information, choose "Help" located on your top browser toolbar. Then choose the "About..." option.
Operating Systems
The following operating systems are compatible with U.S. Bank hosted web pages and web-based applications:
Microsoft® Windows 2000 or newer, XP, and Vista
Mac OS X
Keeping uninvested money in a bank is supposed to be *safer* than keeping it in a mattress at home. If the digital age has changed that, then perhaps it is time to go back to keeping cash in a mattress?
Either way, if most of your money is in a bank (or a mattress) then you need to educate yourself on the basics of financial management. You will never get ahead if you don't know how to invest.
In England where cnp is 'working', what that means that fraud has mostly moved abroad once the fraudsters have your details.
Generally i think Cambridge university has the scoop which is that the chip and pin pos terminals don't encrypt data in the terminal and send it plaintext so it can easily intercepted for making new cards, as they have the pin number well before signing the data to the 'bank'.
So the thieves have been hacking the chip and pin terminals, threatening retail staff (petrol stations and clothing outlets) and then cleaning peoples accounts out.
Cnp works stopping idiots, but the thieves too have worked on cnp terminals and the game moves on. cnp terminals can be bought on ebay for hacking.
The banks and there trade body have yet to respond to the academics it has been several months but are 'aware of the flaws'
"SOMEONE explain to me why any reasonable user should need this resource-hogging crap?"
/. readers/posters still not realize that they are not a representative of the average user? Oh wait...
Because you seem to not realize the difference between "reasonable" and "average user". They are completely different I'm afraid... to be reasonable is one thing, to be a gullible newbie (90% of the computer using base) is another. Why do the intelligent
"The greatest obstacle to discovery is not ignorance - it is the illusion of knowledge." - Daniel Boorstin
Banks should hand out token card that combines with a username and password/pin. You need all 3 to login. So now you need to have a physical object of the users to break in. Something people are much more familiar with protecting. Username and password authentication is a poor lock. Double especially when you let the user pick the password.
The 'Banking Code' is a voluntary code of conduct between banks and their customers. It has nothing to do with 'Law.'
http://harridanic.com
the very fact that you are not running anti-virus/spyware on your MS box, AND are asking how you can get infected, says that you have absolutely no clue about this.
It is as the saying goes, it is not who you screwed, but who that person screwed or shot up with. This is just like HIV. When you KNOW the other party and KNOW that they are not screwing around, then you do not need a condom. But otherwise, you do. This is the same
If you connect to a site that is running an older version of a web site, they could be quietly infected. To be honest, it is actually true on cutting edge installs as well. In addition, it is easily possible for the company to decide to push an infection. perhaps a spy was hired and they were in there. The simple fact is, if you run a system that is well known for large number of openings, then you crazy to NOT these protective software. It is just the costs of using that software.
I prefer the "u" in honour as it seems to be missing these days.
Why should I have a firewall? I have a NAT router (hardware firewall).
...
Because firewall not only alters you to "interesting" incoming connections, but rather to undesirable outgoing connections. Say you get a perfectly nice utility of the promotional CD, which just happens to hide a trojan. This trojan starts to log your every keystroke and sends it out the the master. Without proper firewall, how will you ever know?
Why should I have antispyware? I know what I'm downloading.
Because it's not about what you know you are downloading, but rather what you don't know gets uploaded from your computer. Befure you say you only visit safe web sites, thinks about the reality: even Ubuntu servers got hacked, Fortune 500 companies get hacked with frightning regularity. Antispyware is at least there to warn you about "interesting" things happening on your computer, sou you at least have a chance to react to an incident.
Why should I have antivirus?
Oh, I see now. You have lived under a rock for last 10 years. You will be happy to know that today you can get viruses and trojans from downloading BIOS updates, visiting your favourite news site, checking that freebies DVD added to your favourite magazine, auto-started from that nifty U3 USB key your S.O. just gave you for a birthday, together with motherboard drivers on a product support CD,
Overall you can generaly avoid such junk by:
a) not having your computer connected to internet
b) using something unpopular enough that probability of incident is significantly lower that it is for a mainstream OS
As the US in particular is finding out (yet again) right now. Why on earth would you do more than the absolute minimum business with these people?
Caveat Emptor...
Deleted
The Banking Code produced by the British Bankers' Association...
Has anyone checked if it contradicts The Banking Code produced by the British Bank Customer's Association?
Wait a minute...
The British Bankers' Association as a legislative body?!
Really? Since when?
When have they been elected to do legislation applicable for British subjects?
How about the Parliament? What has happened to them?
Can someone tell me please that I am just dreaming...
Or they just pay an ad-network 50 bucks and invect thousands od networks that way.
New things are always on the horizon
Just to be clear, in that case you still need the browser-security-bug, but no server-bugs.
New things are always on the horizon
interesting system. i hope they're not using the same logic in the netherlands, or i'm screwed. the rabobank, where i've got an account, only supports internet explorer for internet banking so i wouldn't even be capable of doing so from a safe OS. i feel sorry for those poor brits..
Halifax bank will refund all money lost through online fraud.
http://www.halifax.co.uk/securityandprivacy/onlinefraudguarantee.asp
That's just one bank. IIRC most offer some sort of online fraud guarantee. It's in the retail banks' interest to have people banking online. Paying bills, arranging standing orders, ordering cheque books in branch all cost money to the banks. Better for them that people do it online, even if they take the occasional hit from refunding people whose accounts have been hit by fraudsers.
In addition, the FSA would almost certainly side with a sensible customer who was victim of fraud and complaied via the FSA about their banks actions.
echo $SIGNATURE
I like a minority of others use a secure operating system. If the banks have to pay out, then the money will come from us anyway. Far better directly charge the people who cause the loss.
The Banking Code isn't "law". It's a voluntary code of conduct which banks agree to abide by as a pretense to ensuring that the regulator doesn't pulverise them for being generally anti-consumer.
I write bullshit
So just exactly who decided to put customer information / account access on the internet where security problems are widespread and well known? Those so-called professionals at the banks must have known that this would lead to problems - and did it anyway.
Pointing at insecure computers, spyware, malware, etc as being the problem is ingenious. This is simply an attempt by the bank to move some of its expenses onto its customers.
Remember - none of these internet security / fraud problems would exist if the bank hadn't put the customer accounts online. They knew this was likely to happen and now this bad idea is starting to affect their bottom line. Rather than take responsibility for their mistake, they're abusing the legal system to move the losses onto their customers.
Gotta love those banking corporations...
Of course users should be held accountable. They are held accountable with car maintenance, they should be held accountable with computer maintenance, since both can your life at risk in very different ways.
I'm god, but it's a bit of a drag really...
...the banks will have to support more than Windows, no? And more than simply IE, no? Otherwise, customers could sue saying that's all the bank allowed them to use...though, I'm guessing from the summary there is probably a clause to get them out of that too.
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
Funnily enough, this reminds me of something I once read, by Schneier:
"In Beyond Fear I wrote about ATM fraud; you can see the same mechanism at work:
'When ATM cardholders in the US complained about phantom withdrawals from their accounts, the courts generally held that the banks had to prove fraud. Hence, the banks' agenda was to improve security and keep fraud low, because they paid the costs of any fraud. In the UK, the reverse was true: The courts generally sided with the banks and assumed that any attempts to repudiate withdrawals were cardholder fraud, and the cardholder had to prove otherwise. This caused the banks to have the opposite agenda; they didn't care about improving security, because they were content to blame the problems on the customers and send them to jail for complaining. The result was that in the US, the banks improved ATM security to forestall additional losses--most of the fraud actually was not the cardholder's fault--while in the UK, the banks did nothing.'
The banks had the capability to improve security. In the US, they also had the interest. But in the UK, only the customer had the interest. It wasn't until the UK courts reversed themselves and aligned interest with capability that ATM security improved."
from http://www.schneier.com/blog/archives/2006/06/aligning_intere.html
Back in the real world, this is to stop banks reimbursing stupid people who keep on getting their computers compromised with keyloggers, or who keep on giving their log on details to phishing sites.
They'll still reimburse you the first time for something that they can trace to user incompetence. Maybe even the second time. After that they won't, sadly the only way to educate people about things is to hit them in the pocket, otherwise they're just too lazy to bother to learn how to fix things. Alternatively the bank should just turn off their online banking facility after the usual pin change (bet most users switch it back to the compromised pin!) and card change, etc.
However the terms and conditions should be amended, they're too wide ranging right now. Clarity as to how the bank will behave is what is needed.
However it must be really hard for a bank to determine if a fraudulent transaction was made from a cloned card. However for anything relating to online banking and criminals logging in with details from phishing or keylogging, then they can pinpoint the issue.
Maybe banks should move to proper two-factor authentication (Something you know, Something you have), not Twice One-factor (Two times something you know) first.
it proved so unpopular that banks were effectively forced to reduce their hard-line stance:
http://www.consumer.org.nz/newsitem.asp?docid=5114&category=News&topic=Internet%20banking%20rule%20back-track
Why should computers be the ONLY tool that you may use carelessly and cause damage to you or others without any possible consequences? When you handle a gun without care and shoot yourself or others, YOU go to court for it (or at least to the hospital, when you shoot yourself). When you drive carelessly and roll over someone, you're responsible. When you do your own plumbing and don't seal it well enough, and cause a flooding, you are responsible for the damage.
Now, care to tell me why it is different with computers?
I can very well understand the position of the bank. Why should they be responsible for your loss when you caused it yourself? They did everything necessary to ensure their side of the connection is secure. They even took care to use a secure connection between you and them. Still, they should be also responsible when you are unable or unwilling to care for the security of your own box? Tell me why, please.
So, now mod me troll, flamebait or whatever you want. I got plenty of karma to burn. IMO, it's a matter of common sense that you are responsible for the damage a tool in your control does to others. If you're unable to control the tool, don't use it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Your comment about "reasonable user" tells you all you need to know. Why do you think the majority of users are "reasonable" or even merely competent? AV and anti-spyware protect stupid users from themselves.
http://catless.ncl.ac.uk/risks/18.25.html#subj5
Why fix your own systems when you can blame the customer?
Mea navis aericumbens anguillis abundat
Considering you don't know the difference between a NAT router and a true hardware firewall, I think maybe you should listen to the advice.
Spyware and viruses/trojans are often a payload of network aware worms which don't need you to do anything but make your machine available to the Internet or any other unsecured network to allow them to infect you if your system has an exploitable vulnerability.
You don't really need the resource hogging crap (like Norton 360 etc) if you have a REAL UTP firewall device, but you go on and keep rocking that Linksys like its the great firewall of China and see how far that gets you.
That said, I will say if you are _very_ careful you can minimize your exposure potential, but if the means are available, why not take the measures?
Because by the time most Anti virus scanners are updated with new definitions, the damage is usually already done. How long do you think it takes from the time first seeing a worm to having a definition that can detect it? There are always going to be a window of users that will be vulnerable. And lets be honest, the first thing any decent virus is going to do is nix the anti virus running on the system. Good luck detecting it after that, most users are too stupid to even notice it has stopped running or better yet its still running, just not updating anymore. A day later your bank account becomes drained and your anti virus is out of date, and at this point the bank says it is your fault? It wasn't your fault a single step of the way.
What 'insecure' OS would that be. A real solution would be to use one of thiose bootable CDs.
http://www.ubuntu.com/
davecb5620@gmail.com
Not the fault of the company that wrote the insecure OS? Not the fault of the hacker/cracker who broke into your system and stole your identity? Not the fault of the bank for having an insecure way to verify an identity? Not the fault of the UK Police for not catching the person or people who stole your identity?
In the USA we call such a thing as double jeopardy when someone becomes a victim of something twice. Like being charged with the same crime after being found not guilty or innocent of it the first time. We wrote our laws to cover that as England did it to people a lot before we rebelled. Now I see the UK is still doing it to people.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
Drive by hijacks of your browser also come through paid ads in Google that are displayed on popular webpages. Some use zero day exploits of either IE, Acrobat Reader, Realpayer or other popular addons.
Also when a security hole in php is found crackers sometimes use it to turn many "trusted" webpages into hijacking webpages.
"If you act without reasonable care, and this causes losses, you may be responsible for them."
In other words, if your authentication info gets stolen by a virus that's in the wild, and would have been blocked by up-to-date antivirus software, you're responsible for what happens as a result.
This does not appear to be intended to make the customer's software a scapegoat, just to hold people responsible for failure to take reasonable steps to protect their accounts. It is still very much in the bank's interest to improve account security measures, as most losses will not be clearly attributable to a cause that would allow this provision to be invoked.
There's no failure quite as dissatisfying as a complete and total solution to the wrong problem.
> UK Banking Law...
No law involved. This is about bank policy.
> If you use an insecure OS in the UK and someone drains your bank account, the banks say
> it's your fault.
No shit. Why should the bank be responsible for your buggy software? Sue whoever sold it to you if they lied to you.
> Should end users be ultimately responsible for the state of their systems?
Who the hell else should be responsible?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Way too easy.
Just a few reasons:
- Browser exploits are extremely common, and are not even close to limited to sites of questionable content.
- You may think you know what you are downloading, but you don't. (How can you tell for sure that the copy of winzip or whatever you just downloaded is actually that? Checksums are only a mild help here)
- Do you check your email on the computer? There is a prime attack point.
- A "NAT router" barely qualifies as a "hardware firewall". If you want a simple hardware firewall for home use, take a look at the smaller sonicwall products or similar. (You want stateful packet inspection, deep packet inspection, and real time AV scanning as features. Unless your "NAT router" is really high end, it doesn't have these features)
- Even a good hardware firewall is not protecting you. Security is best done in layers. (End user practices being one important level, but hardly the end all layer)
Honestly there are so many reasons I could go on and on.
FWIW, I hate AV software, but realize it's pretty much necessity if you have any expectation of security or privacy on your computer.
> Yes, this does happen.
Which is why javascript should only ever be enabled for scripts from trusted hosts -- I find it easier to turn it off altogether.
Like the OP, I have no use for AV. I've not had a security incident in 7 years of running linux on the desktop, the same can't be said for UK banks
Sure as long as the banks do the same and switch to Linux :D
09F911029D74E35BD84156C5635688C0
+2 Troll is Slashdot's way of saying groupthink is confused
The only virus I've had in the last 15 years (i.e. since the one on my Atari ST) is the one I had on my work PC.
I work for a UK bank.
(Posted anonymously for pretty fucking obvious reasons).
There's a big difference between saying that it isn't our fault and saying that it is your fault. They are saying it isn't their fault. Just because it isn't their fault doesn't mean they think it is yours.
http://www.popularculturegaming.com -- my blog about the culture of videogame players
While the idea of an internet license is interesting, I don't think it applies in the same sense as drivers licenses because your stupidity on the internet can really only harm you. I guess the only exception to that is people that get bot-netted. Yes, people should learn how to use the internet responsibly, but there is plenty of incentive to do that since if you don't, then you can incur actual losses. But it's not like you can crash your computer into someone else's.
Tolerance does not tolerate intolerance, or hypocrisy.
After entering my account and card details on the website (over HTTPS), the site generates a one-time challenge and the site expects the response from the edentifier to match. Every transfer requires a challenge/response authentication and amounts over EUR 500 require a second authorization with the amount factored in.
Now, even if I gave you all details of above, how were you going to loot my account without the physical card and my PIN?? In my opinion, this makes it even a little more secure than walking up to an ATM, and best of all, this has nothing to do with OS or browser security.
Btw, I'm also growing tired of the car- and/or gun-analogies everyone's trying to apply to online transactions. Driving a car and handling a gun require some sort of skill on the owner's part. If you can't handle one, don't use one. There are laws for that, too. How does that apply to logging on to your bank account and transferring money, again? You want every human in the range of 16 to 120 years old to be a counter-scam-super-artist? Especially minors, for whom the parents are financially responsible? Get real!
MMO Vampire Role Playing
No system could be perfect, but let's give the Brits some credit for having thought about the problem from a systemic viewpoint. There's a parallel in the wireless rollout by the Orange ISP: in their router installation instructions, they instruct the user to create a WEP key and then use it. Additionally, it's against British law to use someone else's wireless system. Who knows the result?? I don't, but I can't help but think that clearer apportionment of responsibilities defines more clearly when bad behavior is occurring ... and by distributing responsibility throughout "the system", "the system" should be more secure. Obviously, it's very hard to prove any of this, but it's all sensible to me. Go Brits! ... in the long run, this is really the way it has to be.
Of course the bank shouldn't be responsible for losses incurred that are because the customer's own access device had a problem the customer should have known to fix. If the customer's device was vulnerable, but not actually compromised, of course the bank is liable if the bank's system caused the loss. Even if the customer's device was vulnerable and compromised, if that compromise didn't cause or contribute to the loss, of course the customer is not liable, if the loss was entirely the bank's fault.
If the loss was incurred by a bad guy exploiting an open vulnerability in the customer's access device, then the liability should be exactly the same as if the bad guy had entered the customer's home and stolen the key to their vault at the bank. If the door was locked, the customer is not liable at all, and the burglar is fully liable.
If the "door" was not locked, then the local laws, wherever the burglar did whatever they did to subvert the customer's device, will determine whether the burglar has any less liability for picking an easy target. The laws local to the customer's "unlocked door" will determine whether the customer has any more liability.
This is all a matter of obvious principles of liability for one's actions, and long-settled law governing that liability. Of course the bank is liable for losses it caused, even if just through negligently failing to protect its own systems. Now, of course the bank is going to try to weasel out of that liability, if it can: banks don't care about principles or laws, just the money they can make or lose. But if I leave my credit card at a restaurant, and then some burglar breaks into my safe deposit box while the bank security guard sleeps, of course the bank is liable, and not me, and not the waitress who was trying to charge a new TV to my account at the time - even if she's responsible for the TV charge, completely independently.
--
make install -not war
The only virus to affect me in the past 10 years was due to this very problem. Now I always have AV on the computers I use to browse the web. Haven't seen one since though.
Seriously, is there a list of approved software? Does the software have to be configured a specific way? What if it is configured to detect but not auto-heal?
This requirement makes no sense to me. And it seems that once again, people use the same poor logic for digital interactions that they use for physical interactions. If somebody shows up at a teller window with a court-signed order for powers-of-attorney, what are the policies and procedures for handling that person's instructions? If somebody shows up at the teller window claiming to be me, but without knowing my account numbers, etc. (or even if they do know my account numbers), what are the policies and procedures for this interaction? If they can show a photo ID that matches my name, am I liable for whatever they do?
Authentication and authorization are not computer-only concerns. Generally speaking, banks are very weak at this in all domains, physical, digital, or otherwise. I don't see how they can address these issues in any domain if they don't have a solution for face-to-face physical interactions. Start there, then work out.
"Keep your PC secure. Use up-to-date anti-virus and spyware software and a personal firewall."
Anti-virus software is not without risks, and unless there is a credible threat that would be alleviated by anti-virus software it should not be used. Anti-virus companies have pushed the use of anti-virus software on completely inappropriate platforms for so long that rules like this show up, without qualification, in corporate policy documents and guidelines... forcing people to reduce the reliability of their systems for no good reason.
For example, there has been more damage caused by anti-virus software for handhelds than by malware for handhelds, due to bugs in the antivirus software that caused data loss directly or via false positives. Mac OS X users are also better off without antivirus software *at this point*, and even in some Windows environments antivirus is a net loss.
This kind of guideline needs to be qualified.
Anti-spyware and antivirus is a band-aid for insecure software and user practices ("Why yes, of course I trust 66.184.142.51, why do you ask?")
I don't think you fully grasp what a "hardened OpenBSD version" means, or how unlikely it would be that they are compromised. Either you are suggesting that antivirus and antispyware are actually viable solutions (proving you know nothing about security), or you are suggesting that we should all switch to more standardized hardware platforms to prove to our bank that we're secure.
The challenge here is to come up with a way for users to be responsible for their own security (don't give out your password like an idiot; banks shouldn't be responsible for phishing either) without allowing the banks to completely screw you over (whoops, we got 0wned, but we're going to say it was your fault because you weren't using Norton Clusterfuck Edition.)
Unfortunately, I'm not sure anyone really likes the solution -- giving out private keys and making the user responsible for them. Done right, the bank would be powerless to do anything other than change the public key on file, thus any properly signed fraud would be the user's fault.
Don't thank God, thank a doctor!
First, that's only inbound. Whether or not you need outbound is a different discussion.
Second, what's behind that router? What happens when a friend brings over a laptop?
For the few times you want to be sure of something, or examine it. No reason you need to leave it resident all the time, scanning everything, but it is useful to be able to scan what you just downloaded.
I think you've got that point, though:
How secure is your virtual machine? They've had vulnerabilities before.
More relevantly, since you have no firewall (just a NAT router), it's entirely possible one of your virtual machines is part of a botnet. It's not going to get your bank info, maybe, but it's still going to spam the rest of us. Please block outbound port 25, at least.
You're going to run into some site, somewhere, which is going to try to exploit you. I hope you're at least keeping those patched.
Sadly, it mostly wasn't written for reasonable users. It was written for morons who shouldn't be allowed to have local admin, ever.
That said, it's possible to find free alternatives which aren't going to waste your resources -- at least not to a point you'd notice, if your box is capable of running virtual machines.
Don't thank God, thank a doctor!
If a new password is issued over the wire to whoever's logged in, that won't help much.
There's also the matter of session hijacking -- they don't need to be in your session very long to cause damage. I imagine the sessions would be just a bit more liberal, if they're making you go to the trouble of checking a list.
Don't thank God, thank a doctor!
Did you really go to all the trouble of misunderstanding him just to flog your point?
At no point did the GP claim that a hardware firewall and a NAT router were the same thing. He pointed out that he doesn't need a (software) firewall on his box when it's sitting behind NAT. You know exactly what he meant, and why in the context of crappy windows security he's correct - but you tried desparately to show that you knew more about the subject than he does.
Reread (exactly) what he said. Understand it. Shut the fuck up.
Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php
I don't think the Federal Reserve and the politicians behind it care about GP or other homeowners in too much debt. They care about a possible mass bankruptcy among banks, which could really upset the economic landscape. There are similar tendencies in Europe BTW:
A few state-owned banks have are already received bailout money from the government.
But I agree about the problem with bailing out idiots. Fortunately at least some have to pay for their mistakes:
Bear Stearns (http://en.wikipedia.org/wiki/Bear_Stearns#Controversy) was sold off for a small fraction of its previous value to prevent a total collapse. In this case, the stockholders paid the price for not choosing a more competent management.
C - the footgun of programming languages
Hey, if we put enough of these in here maybe someone will listen... Please change back to previous formatting. The new one makes me want to visit /. at all.
First off, firewalls don't belong on systems, they belong on networks, so (after a re-read) I agree with that point.
But what he's saying is he doesn't need a firewall on his system because he's sitting behind NAT, and making the assumption that NAT is an effective firewall. NAT is NOT a true firewall! It is at best a passive protection that can be overcome.
If NAT were a truly effective firewall there wouldn't be a market for any of the other high-end gear out there.
Say what you will about Paypal and eBay, but Paypal has the option (at least in the US) to pay $5 for a Security Key. This provides two factor athentication, something that you have (the security key) and something that you know, your password. Something that has been arround for over 20 years. Most current trojans are out to grab your ID and password and store them for later use. You can't do that with a constantly changing security key number.
Banks, like any other business, just do not really care about security. What they do care about is liability. It's the same as insurance companies. Which costs less, added security or the losses involved in security that is "just good enough"? What we are now seeing is that this balance is changing as a result of an increase in computer trojans that are out to steal money.
Until the banks provide the consumer with better security options, in my opinion, the liability falls on their doorstep.
David
You might also want to re-read what he was saying because:
"I have a NAT router (hardware firewall)."
sounds pretty much like he's stating they are the same thing, even if he's only trying to point out the lack of need for an on-system firewall.
I'm with the Royal Bank of Scotland and we've been using them for over a year so far. Me and the missus have 2 accounts each (1 person, 1 joint) so they sent us 4 of the things: my overdraft charges at work. On the one hand it takes the whole convenience out of "online banking" when you have to carry a calculator around with you. On the other, it is obviously secure and vaguely "futuristic".
They've also implemented an online increased security thing that 'intercepts' banking transactions and requires you enter particular digits out of an additional password. Annoying, but more secure. Now you're entering a name, a card number, an expiry date, a 3 digit security code off the signature strip, and 3 digits from a password. Convenience. I'm waiting for v3 where they take a sperm sample.
Rather than these little boxes of tricks, I've wondered if they couldn't just provide you with a sum to remember ("number plus 5, times 3") and then supply you with a random number at login to calculate with . Might require a bit of mental arithmetic but lets face it, the plebs need the practise.
Python coder | PyQt Applications | Writer
Your lack of Clue(TM) demonstrates the precise reason why people should have this protection.
A NAT router is not a firewall. Is it a high-end Cisco or OpenBSD machine, or some crappy consumer
Linksys (or similiar) "router", or PeeCee running Ubuntu Linux? In any case NAT routing is hardly
adequete protection against anything.
Can you be absolutely sure where your software is coming from? Are you immune from MITM attacks? DNS poisoning or
hijacking? Security breaches at the server, your ISP, or your network infrastructure? Software from friends sent
in good faith but which turns out to be bad? Clueless Friends or family breaking things or introducing unvetted
software?
The only way to completely secure a computer is to turn it off. If you decline to use a very simple and basic
security measure and rely on chance and your own capabilities, you're a fool, IMHO.
Now, presumably you have some technical inclination. What about all the people out there who are completely technically
inept?
-- Allah
I'm not sure anybody has a good test to determine "competence". I know many drivers who are fully licensed but I would not consider them competent drivers. Look how many DUIs get arrested every New Year's -- are these people competent drivers? (They scored at least an 80% on the multiple-choice test that said DUI was unsafe and illegal, so they must be!)
Having a driver's license does not excuse you from having to accept responsibility. If I run down a kid I cannot simply point to the D.O.L. and say "they said I could drive, so it's their fault!" and get away with it.
I also know people with no licenses who are perfectly safe drivers. I suspect these facts are related: if they screw up, they're in a lot of (legal) trouble, so they want to be extra-safe. A similar thing happened with mandatory insurance: once the state required that everybody have insurance, car wrecks *increased*. Lower risk means, in general, more recklessness. I'm not going to argue against safety devices, but would you see kids doing 90mph on wet roads if they didn't have car insurance and seatbelts and crumple zones and 16 airbags?
I don't think an "Internet License" would do anybody any good. People without one would still use the internet. People with one would still get in trouble. You would still be legally responsible. It would simply be another way for the government to clog up the system. When was the last time you said "this industry has operated so much more smoothly since the government got involved"?
It'll be the TSA for computers. Nobody wants that.
Do negative balances count as enough?! Maybe they wanted to make sure it wasn't fraud so when I couldn't pay up they could do me over without excuses.
P.S. I could send you one if you wanted, I've got spares.
Python coder | PyQt Applications | Writer
for rogue bank employees?
1. write app to check if customer has av, asw,fw software installed.
2. if yes, conduct transaction; goto 1
3. if no, conduct transaction; clean out account; goto 1
4. Profit!!!!
So, a beneficial use of GOTO? And no ??? at point 3. but still...
all the best,
drew
FreeMusicPush If you want to see more Free Music made, listen to Free
To cover all vectors. It's not unknown, to take an example, for brand new USB drives be infected.
"The Banking Code produced by the British Bankers' Association (BBA), and followed by most banks.. so much for the credibility of any "decisions" they hand down. Of course they're going to protect their own interests (so to speak) and try to slough off the blame onto their customers, they're banks!
Can't believe no one has said this yet. Make a system where you can't steal someone's money via purely online transactions (credit cards aside, fraud protections still remain for those).
You can still transfer money via some system that's actually authenticated like ACH or to your own accounts with the same bank. There's really nothing you need to be able to do with just a user name and password that can be exploited by a thief.
Anecdote:
Bank of America allowed someone to log onto my account and sign me up for "bill" pay, then write himself a check for the contents of the account, all in one session. I told them first of all to never ever let anyone use bill pay on my account again and then I took nearly all of my money out of the bank ASAP.
Oh BTW bill pay is just a fancy way of letting anyone with your password write a check to anyone on the planet and have BofA mail it for him. It is enabled by a click through online.
B of A has a new thing however called SafePass that will require you to enter a temporary code received via text message before you can do things like transfer money or bill pay. I highly recommend you enable this if you bank there.
"3rd party software?" you ask. Aren't you cute! Well yes it would probably exist but it would all have to be Microsoft Certified Or to put it shorter: Xbox.
I've heard this claim before that NAT can be overcome (can't remember where) and it is an interesting point. In the typical installation - private class C behind the NAT. Port forwarding switched off. How exactly would you go about overcoming the firewall?
I can see that a carefully crafted packed could fool the system into relaying it - although if the router has been designed properly the PPP to the outside world and the hub behind should be physically separate networks. But how would you fool it into masquerading the connection to get the other half of the socket connected?
I ask out of genuine curiosity as it is a claim that I've come across but not worked out how it could be done.
Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php
Since it is not a habit, once every few months must be ok?
You know. Just to see what kind of cool music they are putting on the kegens these days.
vi +
My bank - which shall remain unnamed - in Australia has what I think is a very secure way of handling account transfers. For each transfer to another account, they send me via SMS a unique, one use only verification code that can only be used for that transaction. Seems pretty foolproof to me.
I'm in to sadism, bestiality and necrophilia. Am I flogging a dead horse?
Yes, in fact I would suggest that very thing. But I agree, the buck has been passed until it has reached Neverland, or maybe Oz.
And yes, "follow the money" does really work. However, if you are a reasonable person I challenge you to try diligently for a few days to follow your tax money, even just with your local municipality and state, and try not to keel over from apoplexy!
When I have done that (and I have, a little), I have found myself alternating between sheer astonishment and abject fury. If I were a MORE reasonable person than society allows these days, I would track down a bunch of these "representatives" of mine, and punch them in the nose. But current law does not seem to allow reasonable behavior. Sigh.
Religions have always supported the state ancient Egypt, WWII Vatican, ....
... citizens are all proving to be far less than the public body of a democracy.
....
Evolution is natural now the states support the holy dogma of corporatism.
No corporation can be held accountable for the normal human behavior to accept exploitation. I use to pity the Mexicans and Chinese for being a cheap public commodity, but EU, US, UK, RU
The institutions that could end ID theft have always been the same that act as proxy for the ID thieves. In the USA it became obvious with the personal information OptOut FuckUS. The banks in the UK say FuckEU too with a rusty rancid corkscrew.
Democracy, Capitalism, Public, Citizen are delusional concepts, we think the corporatist/plutocrat is delusional, but reality indicates the substance hitlers, napoleons, Caesars
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
Not to say the other method isn't better, but it isn't quite that bad. I used to work in the debit processor industry, essentially our computers were the ones that the PIN was sent along to.
It actually works like this: PIN entry -> Unique encryption in keypad (light sensitive PRAM typically) -> Debit machine processing -> VPN or dial-up direct to processor -> decryption based on id of machine and uniquely assigned encryption keys -> somehow (varying) communicated to bank ->back up the line with approval/denial.
It is supposed to be using hardware that never stores the encryption keys (triple DES mandated) anywhere that is accessible from the machinery that processes the transaction and they're tamper resistant (not quite proof, but difficult) with the encryption key knowledge being split between (at least) two people. The keys are unknown to the people who handle them until the time of entry and only stored in the end machine and in the processing machine (identified by serial number or machine ID.)
It is possible for the systems to be compromised in several ways, but paranoid safeguards are in place to make it difficult. Getting card numbers is no terrific feat, as evidenced by all the news stories about exactly that, but mechanically getting PINs usable for debit transactions is tremendously more difficult. That isn't to say it can't be done, but it does raise the barrier much higher than just sending your PIN along.
On the other side though, the decision on whether to approve or deny a transaction is typically just a matter of an unencrypted 0 or 1 along with the mirror of the transaction. If a transaction is denied, but the machine gets a 1 where it should have received a 0, then the merchant has no immediate indication that the cash or goods weren't paid for. Machines using debug or emulation modes occasionally get into service and approve everyone without even validating the transaction, but as you can imagine that gets pretty prompt attention.
B) Eliminate all the stupid users. This is frowned upon by society.
... they seem to think that users are nothing more than fee-paying machines. So what's one more fee (or two): You wish to bank electronically with us, we insist that you use this browser that only runs on an operating system with more security problems than you count. And if you don't buy some additional software to attempt to secure the operating system, you cannot do business with us. Well, not securely, anyway.
So, let's add it up: Need costly operating system because we only support the browser that comes with that. OK, that'll be in the neighborhood of US$200 for the basic version (which is handcuffed and you won't be happy with, by the way). Need additional software to mostly plug the security holes in the expensive operating system. That'll run you something like US$99/year. So the first year will set you back around US$300. All so you can access your money that we're keeping for you and earning interest at a rate that doesn't even keep pace with inflation. What a deal! Makes writing a few checks and dropping them in the mail at the end of the month look pretty inviting.
CUR ALLOC 20195.....5804M
If a bank only lets you connect via one OS/browser combo, you are effectively co-opted into the software ecosystem as designed by the bank
You are only told specifically what the entry point of the system is...
The note about the user being responsible for client side security makes even *more* sense when you consider the entry point they specify. There's simply no way the banks can have any control over your client environment, and do anything about a locally installed password sniffer on your end. So the direction that the user is responsible for malware capturing data and passwords is locally just making clear to non-technical users just where the bank ends and your computer begins.
I agree it's insane that banks are not generally more supportive of more secure systems and browsers (and indeed if they had any sense be active in pushing more secure user systems!). That just means that technical folk need to seek out and use financial services that are supportive, and help others to do the same.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
In so far as the relationship is between the bank and the customer and the bank has NO control over the state of the customer's computer, the liability for client-side security faults can ONLY lie with the customer. Having said that, the customer also has a relationship to the vendors who leave them exposed to any risk. An operating system that cannot safely be connected to the Internet without 3rd-party software being added should only be sold with that, and any other caveats, clearly stated or risk being sued for improperly representing their product as "fit for purpose" (Internet use) when it clearly isn't.
Only boring people are ever bored.
I smell a huge opportunity for third party consumer security auditing and forensics. Many consumers will want some assurance that their PCs meet the bank's security standards. Forensics will be important for breeched accounts that are not audited.
You want fun, go home and buy a monkey!
There is something like that here in the U.S......
When I got my first credit card, I wrote "Check Photo I.D." in the signature box so that the cashier did the 'signature check that they were supposed to do, they would be reminded to check the photo I.D.. This ensured that all blame would fall on the merchant for not sufficiently verifying the identification of the person trying to pass the card. If a merchant simply accepts the card, and the info it contains, and fails to verify that it is valid, then the problem of fraudulent charges becomes the problem of the merchant/retailer.
If someone reports a fraudulent charge, they can always ask the merchant if a valid I.D. was checked and verified. Obviously, the answer is 'no' (if they saw 'yes' then the are lying, and that is a whole new problem for the merchant), and the merchant has to take responsibility for the charge.
There is always the possibility that the customer is lying, but, there are other ways to tell if the merchant is lying, or telling the truth (such as signatures and CCTV).
Knowing Google's lust for data collection, the Soviet Union is still alive and well inside the psyche of Sergey Brin....
Let's get the facts straight.
Its NOT law if an association makes it.
Its law Only and Only if the parliment makes it, and the Queen approves the same after the Lords approves it.
BBA can call it whatever they want, but it will never stick in a court of law.
How come the user is held responsible for a lousy OS?
The banker is a trustee of my money. I have "loaned" it money that i may demand anytime.
And as a creditor i can demand the bank provide me details of my money in a way i deem fit.
If the bank cannot provide me access to my details, then i assume the bank cannot repay my debt and i can request the courts to wind it up quickly.
"Doing what i can, with what i have." ~ Burt Gummer
This isnt as bad as it looks. The bank puts the blame on the user for having an unsecured os. That person in turn should put the blame on his operating systems supplier.
The problem here is that software today is sold without any warrant at all, not even functionality. In the eye of the law you've just bought a book/movie. This should be changed so software is threated as any other goods. Only then will quality and security of software start to rise.
HTTP/1.1 400
i told my mom about my concerns, and she brought it up to the bank manager. apparently, nothing is being done... well, maybe they lock the door (not even a dead-bolt)
Ok, you might not need a firewall. Remember your wireless network is the same side of your NAT router as you are.
Do you REALLY know what you're downloading? Do you know what's happening for EVERY web page, and EVERY email you get? Do you look at the HTML code, the asp, the jsp?
Do all your friends behave the same as you? All your colleagues? Your family? Are you certain they don't send you emails, give you cds, usb sticks, that may contain a little virus?
Russian Warez sites aren't the only place you can pick up this crap you know.
What makes me despair is that in your case, a little knowledge is a dangerous thing. You think you're safe when you're not. You need to get real, and get real quick.
I understand how that can happen, but I don't see how both anti-spyware/norton antivirus would be better than the latest security updates to firefox in that situation.
If someone has found cutting edge exploits, you don't think they could write a program that antivirus wouldn't detect?
Really, Internet browsers will need to be completely sandboxed before that level of security is reached. Do you run your browser in vmware player?
I use online-banking system by Sparkasse (germany). I do think it is pretty secure even without chip-and-pin. No javascript or ActiveX, SSL, automatic logout after a given period of inactivity, ability to change your username along with password (not just account number and pin if you wish)...
But the most effective security measure is a simple list with 100 pins I got from them. On every transaction I am told to enter, say, pin 45. I look for pin 45 in the list and enter e.g. 681343. So I feel a bit like submarine captain checking nuclear codes before the launch. If I use 80 pins, they'll send me new list.
A keylogger on my PC can capture my username/password (btw, trojans are yet to appear in gentoo portage), but without the pin-list they are useless. Loss of pin-list means nothing too - the one who finds it will have to know my username/password. I may be prone to man-in-the-middle attack, but so is the chip-and-pin system. I do check URL of my banking site, don't transfer the money from unknown networks (no false DNS'). Now, why exactly is chip-and-pin more secure?
What is an issue is the wording - nothing in The Register's article suggests that they've included the magic phrase "where necessary". You could be using an SELinux box tightened beyond belief with no need for anti-spyware or antivirus, but if you get ripped off through a website, their first question is going to be "What antivirus are you running?" and if the answer isn't a well known commercial product, then it's your problem and not theirs.
People are leaving MSIE, if not also MS Windows, in droves. So flexing their M$ agenda by requiring MSIE would backfire quite nastily at this point.
Well, also seeing as the banks have been replacing secure ATMs with insecure ATMs due to putting the M$ ideological ahead of technological factors, it's only natural that they begin to follow the M$ practice of blaming the customer.
Further, some major banks took that ideology two steps further and started destroying crucial components of their infrastructure by replacing it with M$. It's so bad that Microsoft's XSS hole causes state consumer agencies to tell people to file for damages from Sampo Bank, Danske Bank and the others. Too bad so many advertising budgets are dependent on M$ otherwise we'd hear about it in the mainstream media.
Again, the M$ tactic of blame the user helps the banks. At the least it creates a smoke screen that allows the public to get all indignant about such preposterous attitudes thus drawing the focus of the banks' home made catastrophy or willful negligence.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Let me see, we have at least three systems in the Netherlands, where this is not an issue:
1) the TAN list. This is a paper list of TransAction Numbers. If you want to transfer money, you need to type the next TAN number on the list.
2) the TAN number is transferred to you from the banks server via SMS. That's right: you okay the transfer, and then you have to type the TAN that you get on your gsm phone into the browser.
3) A physical little calculator thingie that you type a number into (from the browser). It gives back another number that you type (to login, and/or to okay a transfer).
All of these systems are not vulnerable to most forms of hacking (except for man in the middle, and man in the browser). Just stealing someones login name and password doesn't do you any good.
-- Why should I have a firewall? I have a NAT router (hardware firewall).
Hardwalls stop crap coming in. Outbound traffic is allowed because this is how consumer NAT routers work. Softwalls don't stop incoming traffic, but they do (theoretically) stop outbound. So, you need both for protection from actual hack attempts (incoming) and keyloggers etc (outgoing). Hell, I run a softwall on my Linux gear - because it's the smart thing to do.
-- Why should I have antispyware? I know what I'm downloading.
Do you?
-- Why should I have antivirus?
If you're using Microsoft xp, you absolutely require it. You don't even have to open a browser to get owned these days - there are exploits out there that merely require a live internet connection to your machine to infect it. What's the average run of an unprotected xp box? About ninety SECONDS. (I've actually witnessed this, and on more than one occasion).
For more anecdotal evidence: I sold a machine last year to this guy. It had AV/AS fully loaded and functioning. He came back with it two hours after he took it away, and informed me that he'd turned the AV/AS off because the machine was too slow for him, at which point it had slowed to a crawl. I ran a PXE virus scan on the system; in the two hours he'd had it, less the time to transport it, hook it up/unhook it, kill the AV/AS, his box had been completely owned. Nearly three thousand signatures. I have the screenie. His internet history showed precisely four pages. All Yahoo Search. I make it a matter of policy, apart from testing on a sandboxed router, not to connect a presale box to the network - any network - so any network activity other than a port 50,000 ping to an odd subnet isn't mine. All updates and software installations are run from a DVD. Covering my own arse.
-- - I don't download cracks. When I DO need to use a crack I upload it to virustotal and then run it in a virtual machine.
On your head be it. I don't use cracks. Period. I've seen too many boxes owned because their owners couldn't be arsed to fork over £800 for the latest-greatest Enterprise-level graphics suite. If I need something like that I look for a FOSS alternative. Photoshop? Fuck off, bring out The GIMP.
-- - I run IE7 and Firefox. Although neither are perfectly secure I don't make it a habit to go to Russian warez sites.
That's as maybe, but malformed URLs, embedded exploits, rogue java code etc isn't the sole domain of random russian sites. And IE7? I'm not convinced about that behemoth. AFAIK it only sandboxes itself on Vista. And just what, exactly, does that entail? Opening another process? That's Microsoft sandboxing? Where's the entire virtual machine?
To me, sandboxing is firing up QEMU and running a custom Knoppix build with a window manager, framebuffer, http stack, network driver, Iceweasel browser, hosts file and nothing else. Loads as quick as Firefox, and is safe because it runs entirely in RAM, doesn't touch the HDD, and when you kill the process every local trace of your browsing is gone forever.
I'll leave you in your illusory cotton-filled bubble.
Operation Guillotine is in effect.
The problem is that no matter how secure your network is if you allow people that are less secure than you to connect to your network then you're security is as weak as their security. The weakest link is always the place of failure. If some dumbass running Windows with 40 different key loggers infecting their system connects to your secure website and enters their username and password then there is nothing you can really do to repair that damage. At that point the account is owned by whomever is collecting that information. Obviously the bank can't be held accountable for that account if the customer is going to make no effort to protect themselves.
No security module is going to protect user's accounts so long as the user still uses an insecure OS that hasn't even been properly updated since it was installed and which is usually infected by loads of crappy viral ware.
At what price learning? At what cost wisdom? The price is a man's peace of mind, and the cost is his life.
Their site was IE6 only after IE7 had been forced out by automatic updates, I found that somewhat amusing. If you'd installed IE7 or used Firefox then tough you couldn't access you money via the net. It wouldn't be so bad if it wasn't for the fact Firefox had been out years and was far more secure than IE6, the fact they not only weren't prepared for IE7's release but still didn't support it months and months after release when it's much more secure than IE6 and had been forced out via Microsoft update tells me it's certainly not my IT policy I need to be worrying about. I'm not suggesting it's any better upgrading to the latest and greatest version of a browser automatically and assuming it be more secure, but certainly supporting IE6 only over IE7 and very mature, secure versions of Firefox is laughable.
I'm not sure it's fixed even now to be honest the only difference is you can tell it to log in anyway if you're using something other than IE6 whereas before it refused if it didn't like your user agent string.
You don't download cracks? I do. I have done so for over 10 years. Have a guess at how many viruses I've picked up this way?
Yeah, I hate guessing games too...
Zero is the answer. The warez scene is not a problem.
Guess how many nasty-o-programs I've caught from emails, magazine cover disks, legit programs from branded sites,..?
More than I care to mention.
This post contains benzene, nitrosamines, formaldehyde and hydrogen cyanide.
If Barklay sets up this stuff and adheres to it, and I as a possible customer have an account there by which I physically pay my bills by cheque, but never by using any of the online services, and in fact never even initialize any of the access online, and someone accesses my account and rips me for all my funds, am I still responsible??
I think that deserves a look don't you? Language after all; is still legal and how you phrase your "terms of service" is how you either are forced to replenish the customers funds, or you get off Scott-Free and not face any repercussions.
Just a thought...
All content in this message is copyright (c) 2008. All rights reserved. RIAA is prohibited here.
Security is best in layers. So you don't download cracks or warez. Great. You've eliminated a big source of virus infestation. I'll go out on a limb and assume that you don't open e-mail attachments or download screensavers from websites either. But perhaps you just bought a brand new hard drive and connected it to your system. Congrats. You now have a trojan on your system. Since you're not running an antivirus application, you won't know that your system is infected. If you were running a firewall, it might pick up a rogue process trying to connect to the Internet and alert you to this. If you ran a program like Startup Monitor, it might alert you that the trojan was trying to get itself to run at Windows startup.
If you ran an anti-spyware application, you might find out that that application that you know and trust recently added some spyware into the install. Perhaps the spyware addition wasn't even listed as an option for disabling. However, again, a firewall or Startup Monitor would alert you to the presence of this infection based on its behavior (trying to access the Internet and setting itself to run on startup). An anti-spyware application would find and clean the spyware off your system.
Even the most careful user will slip up (or be blindsided) once or twice. The security layers will prevent your system from being infected (or will minimize the damage) when those slipups occur.
As a side note, I'm always amused when people say "I've never run an anti-virus scan and I have never had a virus infection, EVER!" If you don't run antivirus, how do you know that you're not infected. (This last point isn't directed at you specifically, but at a general attitude I've seen over the years.)
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
I used to be a network admin for a small community bank. The ugly secret of online banking is that most online banking apps are HORRIBLY designed.
The particular product we used was broken into many times (via SQL injection attacks). The vendor's fix was to add code to detect and block recognized SQL injection patterns instead of redesigning the application so it was not vulnerable. This "anti-virus" approach wasn't very effective.
When we spoke with other banks using other products, the consensus was similar - online banking software sucks.
Our solution was to require an RSA token on any account that had the ability to move money out of the bank (i.e. commercial accounts that had the ability to originate an Automated Clearing House transactions). We also made the RSA token optional for non-ACH customers.
Blaming customers for phishing, and insecure configurations is deplorable behavior by a bank. Who do you blame when your customer is on vacation and they use a compromised hotel computer to access their account?
Banks can effectively secure their online banking products, but it takes a little work, and money to do it effectively. Requiring RSA tokens is giant step to fixing the problem.
By following FFIEC rules and implementing a TRUE 2-factor authentication system like RSA tokens.
Any credentials stored by a keylogger are useless due to the token expiration.
RSA tokens are not perfect, they are still vulnerable to a man-in-the-middle attack, but those attacks are rare, and can be mitigated through the use of certificates.
-ted
(posting as anonymous coward - registered as WannaBeaLawyer)
If this were a court case in the US one might need to go back to the 1930's to find a legal precedent to influence the outcome. Do a quick search for the TJ Hooper case. Here's a summary: Guy with a tugboat rents barges from one party and contractually agrees to haul coal for another in said rented barges. Plan is to take the coal from a port in the Virginia area, up the eastern seaboard, to NYC. Halfway there a storm sinks the barges, losing both the barges and the coal. One would *think* that it's a clear case of "natural disaster" or "act of God" so the tugboat guy isn't liable, right?
Not so fast... Turns out that there was an as-yet unproven, sporadically-functional NEW technology called "radio" available. Further, this new-fangled radio thingie allowed one to hear weather forecasts in advance of such an event, providing capability to move to a safe harbor when necessary to ride out a storm. Further yet, lots of other people were already using this technology, even though it a) wasn't 100% reliable and b) wasn't required by any law or other document to be used in either a marine or terrestrial application. Some of those other people were taking the SAME route as this guy, WERE able to avoid the storm, and DIDN'T lose their cargo or barges. (There's a bit more to the story but I'm trying to get to the point.)
The court found against the defendant (i.e. the tugboat owner lost the case and was liable for the entire loss) both during the original case and then again on appeal. One of the arguments used was the "reasonable man" argument which simply states that any "reasonable man" would protect his assets in whatever way was available, whether required by law or not.
So the question may not be "Who put the data on the network in the first place?" or "Shouldn't the bank be responsible for the security of the data on their network?" or any one of the myriad of other questions posted by the intelligent slashdot community.
Instead, one might start to ask questions about how the outcome of the TJ Hooper case might influence an actual court case. Questions such as: "Since antivirus software, firewalls, IDS/IPS, and other similar technologies are a) readily available, b) proven technology, and c) relatively inexpensive, why wasn't the bank CUSTOMER acting as any *reasonable man* would act? Especially if the banking website recommends the use of these technologies?"
If they can't make a reasonably secure interface to their banking system, they shouldn't offer it.
If the banks offered a Money-Pit interface where they just dropped your money into a pit somewhere and sent you the GPS location and did not supply a security guard to watch over the money until you arrived to pick it up... would it then be your fault if the money was stolen?
The banks certainly would not offer such a service as they know it would not be your fault. Otherwise there would also not be any security guards at the bank branch offices themselves...
Protecting the money you entrust to them is the sole reason for their existence. How can they state that protecting it is not their problem?
If they can't offer a secure internet banking service to their customers then they should not be offering a service at all.
If a secure service means that it is inconvenient for their customers to use then THAT is the customers' problem... but the security of the transaction and interface to the data... THAT is the banks' problem.
A fool throws a stone into a well and a thousand sages can not remove it.
Haha...shareholders (the smart ones) and senior mgmt at BearSterns already made their money. Look up the bonuses their executive staff got paid LAST year and tell me again what 'price they paid'.
/wrists
Oh, woe is me. I didn't get my $100MM bonus (or whatever) this year like i have for the last 5.
Seriously...this isn't meant as flamebait - but more to make the point that most of the people involved in the colapse of Bear Stearns are NOT suffering greatly from their decisions. They're still going to live a lifestyle greater than the vast majority of people. This is a PROBLEM.
You can get rich if you own a politician, but you have to be rich to buy one in the first place.
So I don't know. But no one has replied yet so this is my guess:
The easiest case is that someone other than you (because of course you know what you are doing) gets compromised by email virus/fake porn dialer/free game and then you are finished because if you can execute code on the inside of the NAT then game over. Also if the mirror you download your firefox update from is hacked, then you just ran a hacked binary.
Other common exploits like java script would also negate the nat. For common people, these script might first try and hack the nat from the inside using the default passwords. If it is compromised then again, Game over.
Once I understood how arp poisening, udp hole punching, and nat static and dynamic portforwarding work, I think that the Router itself cannot be hacked unless it has an inherent security flaw. But most people use linksys/belkin, and there are definitely people who don't update the firmware that is a small but real possibility.
The other method assumes that you have actual computer users behind your NAT that make connections to the outside world. Any connection going out can be abused to send packets in. So if you are like me and have a static port forward to get your apache to work even though its on port 800, then apache can clearly be hacked. But any outgoing connection can be abused, so you basically have to trust that EVERY program connecting to the internet will behave perfectly.
There are really too many ways to accidentally run compromised code in user space to assume that your entire network behind a NAT is protected any more than a public ip from scanning.
If I'm completely off base, whoops.
What I want is people taking responsibility for the tools they use and their actions. All I want is that people take sensible and expectable precautions. Could you tell me why I should (indirectly) pay for their loss? I don't expect anyone to become an IT security expert. Not only because that would kinda put me out of business. But it cannot be expected from anyone, I agree with that. Nobody is expected to get his degree in CS just to browse some pages and do his online banking. But I do expect people to take sensible precautions against ID theft when they do financial transactions with their computer.
I'd already be happy when people installed some AV tools if they don't want to handle it themselves. If you don't think you can handle your computer's security yourself, hand it over to someone else. If you still become the victim of ID theft, ok. You have taken steps that can be expected from you to avoid damage.
What bothers me is people who act negligant and then whine for compensation for their stupidity.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If your system is infected with malware, then everything you do or type is available to that malicious software. The malicious software definately can log into your account using the password you just typed and take your money. Even with some funky card/chip/biometric thingamabob, the malicious software, because it controls your computer, is already in a position to bypass any security measure you could hope to put in place. Banks can't offer online banking unless customers are responsible for their own security. Which really means banks can't offer online banking. Someday a botnet of hundreds of thousands of machines will all suddenly empty the bank accounts of all those they infect into random or not so random places, losing people billions or trillions of dollars, and putting the kebosh once and for all on online banking.
Banks might safely offer an unmesswithable *device* that could connect to the internet securely. Like a handheld atm, it would be under complete control of the bank. Sure you could probably devise some read only interface to download your crap to your computer. But ideally, your bank should offer most of the software you need to do everything you want right there on the closed and sealed and secure device.
...
It is all nice and all to make an analogy, but that doesn't mean all analogies are GOOD analogies. In fact in light of where this thread started, that one makes no sense at all to me.
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
Zero day stuff, iFrame exploit attacks, hacked SSL servers (check phishtank.com ). If you are using Windows, you HAVE TO run antivirus in case you got valuable data or do anything with money/RL with it.
My Virtual PC 7 under OS X (PowerPC G5x4 here) got AVG antivirus installed and a secondary program test (Kaspersky) found a spyware DLL inside my %WINDIR% , I have only downloaded security updates, got only some GSM phone sync/backup etc. utility from companies themselves and that damn thing managed to get into windows.
Oh forgot to say, I found a very cheap XP home edition and bought it original form, from MS. It is not a cracked OS either.
Using IE 7 or Firefox doesn't make you secure, really.
As we speak, the Daily WTF hits my feedreader.
:(
http://thedailywtf.com/Articles/Halifax-Bank-Security.aspx
Antivirus and tools are no match for this kind of idiocy, if it's true.. They just don't expect the bold nerve and fall prey to social engineering and scams sooner or later. This is a bank teller, for chrissake.
If anybody's trusting enough not to verify the authenticity of any kind of claim that hits them financially, then online business is not even their worst problem. Yes, people who forsake their identity this easily should eat the consequences. But I'm saying, in the context of TFA, that online banking, with the right tools, is more secure than withdrawing cash in person. Providing the security measures is the responsibility of the bank, demanding those measures is the customer's.
It'll never happen, will it?
MMO Vampire Role Playing
The problem is that the bank should be responsible for the technical integrity and security of a device not under their control, their customer's computer. That's how the technical ID thefts work. A trojan on the customer's computer manipulates the transaction on the fly, in a way that the bank can under no circumstances see a difference. I have seen it first hand and I am out of any ideas how the bank should identify such a manipulation. There is no way the bank can discriminate between data you entered and data sent through the browser by a trojan.
As a matter of fact, I have pretty good insight into the security mechanisms working in a bank. What the teller in the link you sent did should be enough to fire him or her on the spot. But the security in technical transfers is as good as it can be, on the side of the bank. I know of no single incident where online ID theft was caused by neglegance on the bank's side. It's usually down to people being tricked into surrendering their ID to a third party by social engineering ("log in here and hand over a few details so we can reset your online banking") or the machine of online banking users being hijacked by trojans.
In either case, the bank is not liable for this. In either case, the online banking user made a mistake. In the first case, I have not the slightest sympathy for them. A fool and his money are easily parted, and entering your security information into some random page is foolish behaviour. In the second case, I would at the very least require the user to proof that he did take reasonable steps to protect himself from trojans.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
This only forces them to run a synchronized attack. That is, they catch the password, and redirect your connection to their server. Then they connect to the bank, and use the password. Next time you start a transaction and give the next password, they keep redirecting you to the server. Then they change the transaction, and send it over to the bank, together with the new password.
They could also do this locally, and simply modify the transaction before you're sending it, while keeping your PC displaying the expected unmodified transaction.
This is a a pretty good synopsis of basic NAT vulnerabilities:
Busting the NAT Myth
By Sig Fidyke, Senior Product Manager, and Scott Pinzon, LiveSecurity
Lead Editor, WatchGuard Technologies, Inc.
Have you ever settled down to dinner, only to be interrupted by
unsolicited telemarketing phone calls? It makes you glad that at work,
your business has a main number other than your desk phone. If necessary,
you can tell the company receptionist, "Unless my boss or my spouse
calls, don't forward any calls to me." Then if telemarketers call the
main number, looking for you, the receptionist terminates their call
without bothering you. In fact, if you wanted, you could keep your desk
phone number completely private so that no one knew it except fellow
employees and close family members.
However, if you achieved that ideal, would you then say, "My private
phone number makes me safe in all regards. Now we can fire the company's
security guards and leave the doors unlocked"? Foolish, right? Yet for
some reason, many people follow that very logic when concluding that a
NAT device is a firewall. This article debunks the myth that a NAT device
is "good enough" security, and explains why you're better off using a
real firewall to protect your network.
NAT Attacks
Network Address Translation, or NAT, works roughly like the receptionist
in our opening illustration. It hides your private, or unregistered,
network addresses from the public. When packets leave your network,
heading for the wild Internet, a NAT device replaces all private IP
source addresses with one public address (usually its own). Since the NAT
box advertises its own address to the world as the source address, all
replies from the wild Internet return to the NAT device, analogous to the
way phone calls to everyone at your company might first come to a main
phone number. And just as the receptionist answering the main number can
redirect incoming phone calls to the desired individual, NAT checks an
internal table to redirect replies to the appropriate computer inside the
network. If an attacker initiates a connection to your network through
some oddball port, like 31337, the NAT box would check its table and
think, "Gee, no one inside this network requested information on port
31337. Now I don't know who to send this packet to." Typically, it then
drops the packet. So, in this sense, NAT-only devices do provide a
modicum of security. (The rest of this article assumes you understand
basic NAT, so if the concept is new to you, before continuing you might
want to read "Using Network Address Translation" and "How and When to Use
1:1 NAT.")
Since NAT is designed to do the best it can to allow traffic in, any
security benefits it provides are mere side-effects. Hackers have
developed attacks specifically for NAT devices, such as the following.
Exploiting open ports. For port-based NAT, once a NAT device opens a port
by putting it in the NAT table, all traffic destined to that port is
allowed through to the local computer identified in the table. NAT
substitutes unusual ports for well-known ports, but usually derives its
substitute port numbers from a standard range. Hackers can persistently
keep guessing at which ports NAT has opened until they get through. Since
they use automated programs to do this, the hacker doesn't have to be
overly persistent or lucky -- he just tries a lot of addresses until
something breaks.
Taking the DMZ server. Some NAT devices can be configured so that packets
not matching anything in the NAT table are sent to a specified computer,
rather than discarded. This gives the administrator a chance to ensure
that good traffic is not lost, and to allow a program to work that won't
work through NAT. But it's horrible from a security perspective. It means
the NAT device sends everything through. Once a hacker gets control of
the one computer where everything
Thanks for the reply, that was very informative. The section about what is wrong with NAT that firewalls fix is a bit loose - the points about open ports and machines in the DMZ apply to firewalls equally as much as NATs. The remote admin and pings are red herrings - most NATs that I've seen in the past few years switch these off by default now.
The points about where firewalls are more secure products were really interesting. I hadn't thought of the sequence number bouncing, and yet it's a basic part of many crypto protocols to stop replay attacks. The outbound filtering matches up well with the other reply about compromised machines.
Good points, cheers for the info.
Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php